Dark Web Intel: 75 Chrome Saved Passwords Leaked on Telegram

HEROIC analysts flagged this file in April 2026 after a Telegram user uploaded a small export of Chrome saved passwords. The data covers 75 records, each pairing a login URL with a username or email and a plaintext password, the same format Chrome itself uses when you export your saved logins. The count is small, but every single record is a working login, not a guess. Why This Leak Is Dangerous: This looks like a direct export of someone's Chrome password manager, likely pulled by malware running on an infected device rather than assembled from old breach data. Because the passwords are in plaintext and tied directly to the exact site URL they belong to, an attacker does not need to guess which service a password works on. They can go straight to the login page and try it. What Was Exposed: - Login URLs for each saved account - Usernames and email addresses - Plaintext passwords Why This Matters: A stolen Chrome password export often includes logins for email, banking, shopping, and work accounts all in one file, since that is what most people save in their browser. If any of these 75 accounts belong to you, an attacker already has everything needed for account takeover, and reused passwords put your other accounts at risk of credential stuffing too. How Chrome Password Exports End Up on Telegram: Files like this usually come from information-stealing malware that infects a device, quietly copies the saved password database from the browser, and sends it back to whoever is running the malware. From there, small batches like this 75-record file get uploaded to Telegram channels, sometimes shared for free to build a reputation before larger, paid dumps are sold. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including small stealer files like this one. Run a free scan to see if your saved logins have turned up in this leak or any other breach in HEROIC's database.